CodeCow/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2026-07-12 21:04:41 +08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
6fc445ddd9
zulip/confirmation
History
Mateusz Mandera a014ef75a3 CVE-2021-43791: Validate confirmation keys in /accounts/register/ codepath. 
A confirmation link takes a user to the check_prereg_key_and_redirect
endpoint, before getting redirected to POST to /accounts/register/. The
problem was that validation was happening in the check_prereg_key_and_redirect
part and not in /accounts/register/ - meaning that one could submit an
expired confirmation key and be able to register.

We fix this by moving validation into /accouts/register/.
2021-12-01 23:14:04 +00:00
..
management Django 1.10: Remove cleanupconfirmation management command. 2016-11-26 15:04:20 -08:00
migrations migrations: Add progress output to confirmation backfill. 2021-09-17 11:23:32 -07:00
__init__.py python: Normalize quotes with Black. 2021-02-12 13:11:19 -08:00
CHANGELOG.txt Include third-party django-confirmation library. 2012-10-01 10:45:57 -04:00
LICENSE.txt Include third-party django-confirmation library. 2012-10-01 10:45:57 -04:00
models.py CVE-2021-43791: Validate confirmation keys in /accounts/register/ codepath. 2021-12-01 23:14:04 +00:00
README.txt Include third-party django-confirmation library. 2012-10-01 10:45:57 -04:00
settings.py python: Normalize quotes with Black. 2021-02-12 13:11:19 -08:00

README.txt 

===================
Django Confirmation
===================

This is a generic object confirmation system for Django applications.

For installation instructions, see the file "INSTALL.txt" in this
directory; for instructions on how to use this application, and on
what it provides, see the file "overview.txt" in the "docs/"
directory.